feat: wire telemetry checks into startup and backup flows, warnings UI

Wires the telemetry orchestration into the app and surfaces the alerts.

Checks:
- Cold launch: AppStartupBloc fires RecoverbullTelemetryCubit
  .checkOnColdLaunch() unawaited after Tor init — never blocking
  startup, a no-op when the flag is off, Tor is not ready, or the last
  check is still fresh. No background polling.
- Backup flows: the recoverbull feature records this device's own
  operations (store, and fetch via the new status-aware usecase) and
  reports the targeted per-identifier lockout as an alarm signal.
  Global 429 / capacity 503 map to unavailability, never to a lockout
  alarm.

Surfacing (all advisory, all dismissible):
- RecoverbullTelemetryWarnings banner on the wallet home and the backup
  settings screen; strong warnings (suspicious activity, targeted
  lockout) also open a bottom sheet once per session. Acknowledgement
  is remembered so multi-device false positives do not train the user
  to ignore alerts.
- Copy follows the trust model: 'unknown/suspicious activity', never
  'confirmed attack', always paired with 'check whether it was you or
  another of your devices' and 'never enter your seed words or password
  because of this alert'. English and French localization.

The feature stays behind is_recoverbull_telemetry_enabled (default
false) until the server is deployed and the client pinned by SHA.

Bloc test updated for the new dependencies.

Author: ethicnology

lib/features/app_startup/app_startup_locator.dart

@@ -1,3 +1,4 @@
+import 'package:bb_mobile/core/recoverbull/data/repository/recoverbull_repository.dart';
 import 'package:bb_mobile/core/seed/data/repository/seed_repository.dart';
 import 'package:bb_mobile/core/settings/data/settings_repository.dart';
 import 'package:bb_mobile/core/storage/migrations/004_legacy/migrate_v4_legacy_usecase.dart';
@@ -11,15 +12,18 @@ import 'package:bb_mobile/features/app_startup/domain/usecases/reset_app_data_us
 import 'package:bb_mobile/features/app_startup/presentation/bloc/app_startup_bloc.dart';
 import 'package:bb_mobile/features/app_unlock/domain/usecases/check_pin_code_exists_usecase.dart';
 import 'package:bb_mobile/features/pin_code/data/repositories/pin_code_repository.dart';
+import 'package:bb_mobile/features/recoverbull/presentation/telemetry/recoverbull_telemetry_cubit.dart';
 import 'package:bb_mobile/features/test_wallet_backup/domain/usecases/check_backup_usecase.dart';
 import 'package:get_it/get_it.dart';
 
 class AppStartupLocator {
   static void setup(GetIt locator) {
     // Use cases
     locator.registerFactory<ResetAppDataUsecase>(
-      () =>
-          ResetAppDataUsecase(pinCodeRepository: locator<PinCodeRepository>()),
+      () => ResetAppDataUsecase(
+        pinCodeRepository: locator<PinCodeRepository>(),
+        recoverBullRepository: locator<RecoverBullRepository>(),
+      ),
     );
     locator.registerFactory<CheckForExistingDefaultWalletsUsecase>(
       () => CheckForExistingDefaultWalletsUsecase(
@@ -42,6 +46,7 @@ class AppStartupLocator {
         checkBackupUsecase: locator<CheckBackupUsecase>(),
         isTorRequiredUsecase: locator<IsTorRequiredUsecase>(),
         initTorUsecase: locator<InitTorUsecase>(),
+        recoverbullTelemetryCubit: locator<RecoverbullTelemetryCubit>(),
       ),
     );
   }

lib/features/app_startup/domain/usecases/reset_app_data_usecase.dart

@@ -1,13 +1,21 @@
+import 'package:bb_mobile/core/recoverbull/data/repository/recoverbull_repository.dart';
 import 'package:bb_mobile/features/pin_code/data/repositories/pin_code_repository.dart';
 
 // On iOS especially, some secure storage data might still be there after the app is uninstalled.
 // This use case is used to reset the app data when the app is installed again.
 class ResetAppDataUsecase {
   final PinCodeRepository _pinCodeRepository;
+  final RecoverBullRepository _recoverBullRepository;
 
-  ResetAppDataUsecase({required this._pinCodeRepository});
+  ResetAppDataUsecase({
+    required this._pinCodeRepository,
+    required this._recoverBullRepository,
+  });
 
   Future<void> execute() async {
     await _pinCodeRepository.deletePinCode();
+    // The telemetry baseline reveals which backups are monitored: it must
+    // not survive an app-data reset.
+    await _recoverBullRepository.clearTelemetry();
   }
 }

lib/features/app_startup/presentation/bloc/app_startup_bloc.dart

@@ -11,6 +11,7 @@ import 'package:bb_mobile/core/utils/result.dart';
 import 'package:bb_mobile/features/app_startup/domain/usecases/check_for_existing_default_wallets_usecase.dart';
 import 'package:bb_mobile/features/app_startup/domain/usecases/reset_app_data_usecase.dart';
 import 'package:bb_mobile/features/app_unlock/domain/usecases/check_pin_code_exists_usecase.dart';
+import 'package:bb_mobile/features/recoverbull/presentation/telemetry/recoverbull_telemetry_cubit.dart';
 import 'package:bb_mobile/features/test_wallet_backup/domain/usecases/check_backup_usecase.dart';
 import 'package:flutter/foundation.dart';
 import 'package:flutter/widgets.dart'
@@ -35,6 +36,7 @@ class AppStartupBloc extends Bloc<AppStartupEvent, AppStartupState>
     required this._checkBackupUsecase,
     required this._isTorRequiredUsecase,
     required this._initTorUsecase,
+    required this._recoverbullTelemetryCubit,
   }) : _migrateToV5HiveToSqliteUsecase = migrateHiveToSqliteUsecase,
        _migrateToV4LegacyUsecase = migrateLegacyToV04Usecase,
        super(const AppStartupState.initial()) {
@@ -52,6 +54,7 @@ class AppStartupBloc extends Bloc<AppStartupEvent, AppStartupState>
   final CheckBackupUsecase _checkBackupUsecase;
   final IsTorRequiredUsecase _isTorRequiredUsecase;
   final InitTorUsecase _initTorUsecase;
+  final RecoverbullTelemetryCubit _recoverbullTelemetryCubit;
 
   /// True while we're sitting on the splash because a startup step
   /// threw `KeychainLockedException` (iOS pre-first-unlock pre-warm).
@@ -161,6 +164,11 @@ class AppStartupBloc extends Bloc<AppStartupEvent, AppStartupState>
         );
       }
 
+      // Brute-force telemetry check: cold launch only, unawaited, never
+      // blocking startup. The cubit is a no-op when the feature flag is
+      // off, when Tor is not ready, or when the last check is still fresh.
+      unawaited(_recoverbullTelemetryCubit.checkOnColdLaunch());
+
       emit(
         AppStartupState.success(
           isPinCodeSet: isPinCodeSet,

lib/features/backup_settings/ui/screens/backup_settings_screen.dart

@@ -10,6 +10,7 @@ import 'package:bb_mobile/features/labels/labels_facade.dart';
 import 'package:bb_mobile/features/transactions/ui/transactions_router.dart';
 import 'package:bb_mobile/features/recoverbull/presentation/bloc.dart';
 import 'package:bb_mobile/features/recoverbull/router.dart';
+import 'package:bb_mobile/features/recoverbull/ui/widgets/telemetry_warnings.dart';
 import 'package:bb_mobile/locator.dart';
 import 'package:bb_mobile/core/widgets/snackbar_utils.dart';
 import 'package:flutter/material.dart';
@@ -64,12 +65,14 @@ class _Screen extends StatelessWidget {
                   padding: const EdgeInsets.symmetric(horizontal: 16),
                   child: Column(
                     crossAxisAlignment: .start,
-                    children: [
-                      const Padding(
-                        padding: EdgeInsets.symmetric(horizontal: 16),
-                        child: _BackupTestStatusWidget(),
-                      ),
-                      const Gap(40),
+                     children: [
+                       const Padding(
+                         padding: EdgeInsets.symmetric(horizontal: 16),
+                         child: _BackupTestStatusWidget(),
+                       ),
+                       const Gap(16),
+                       const RecoverbullTelemetryWarnings(),
+                       const Gap(24),
                       const _StartBackupButton(),
                       if (state.lastEncryptedBackup != null)
                         const _ViewVaultKeyButton(),

lib/features/recoverbull/presentation/bloc.dart

@@ -1,11 +1,13 @@
+import 'dart:async';
+
 import 'package:bb_mobile/core/recoverbull/domain/entity/decrypted_vault.dart';
 import 'package:bb_mobile/core/recoverbull/domain/entity/encrypted_vault.dart';
 import 'package:bb_mobile/core/recoverbull/domain/entity/vault_provider.dart';
 import 'package:bb_mobile/core/recoverbull/domain/recoverbull_failure.dart';
 import 'package:bb_mobile/core/recoverbull/domain/usecases/check_server_connection_usecase.dart';
 import 'package:bb_mobile/core/recoverbull/domain/usecases/create_encrypted_vault_usecase.dart';
 import 'package:bb_mobile/core/recoverbull/domain/usecases/decrypt_vault_usecase.dart';
-import 'package:bb_mobile/core/recoverbull/domain/usecases/fetch_vault_key_from_server_usecase.dart';
+import 'package:bb_mobile/core/recoverbull/domain/usecases/fetch_vault_key_with_status_from_server_usecase.dart';
 import 'package:bb_mobile/core/recoverbull/domain/usecases/google_drive/connect_google_drive_usecase.dart';
 import 'package:bb_mobile/core/recoverbull/domain/usecases/google_drive/fetch_latest_google_drive_backup_usecase.dart';
 import 'package:bb_mobile/core/recoverbull/domain/usecases/google_drive/save_to_google_drive_usecase.dart';
@@ -21,6 +23,7 @@ import 'package:bb_mobile/core/tor/tor_status.dart';
 import 'package:bb_mobile/core/utils/logger.dart';
 import 'package:bb_mobile/core/utils/result.dart';
 import 'package:bb_mobile/features/recoverbull/domain/recoverbull_failure.dart';
+import 'package:bb_mobile/features/recoverbull/presentation/telemetry/recoverbull_telemetry_cubit.dart';
 import 'package:bb_mobile/features/wallet/presentation/bloc/wallet_bloc.dart';
 import 'package:flutter_bloc/flutter_bloc.dart';
 import 'package:freezed_annotation/freezed_annotation.dart';
@@ -37,7 +40,6 @@ class RecoverBullBloc extends Bloc<RecoverBullEvent, RecoverBullState> {
   final CreateEncryptedVaultUsecase _createEncryptedVaultUsecase;
   final StoreVaultKeyIntoServerUsecase _storeVaultKeyIntoServerUsecase;
   final CheckServerConnectionUsecase _checkKeyServerConnectionUsecase;
-  final FetchVaultKeyFromServerUsecase _fetchVaultKeyFromServerUsecase;
   final DecryptVaultUsecase _decryptVaultUsecase;
   final RestoreVaultUsecase _restoreVaultUsecase;
   final InitTorUsecase _initializeTorUsecase;
@@ -47,6 +49,9 @@ class RecoverBullBloc extends Bloc<RecoverBullEvent, RecoverBullState> {
   _updateLatestEncryptedVaultTestUsecase;
   final TorStatusUsecase _torStatusUsecase;
   final TorConfigPort _torConfigPort;
+  final FetchVaultKeyWithStatusFromServerUsecase
+  _fetchVaultKeyWithStatusFromServerUsecase;
+  final RecoverbullTelemetryCubit _recoverbullTelemetryCubit;
 
   RecoverBullBloc({
     required RecoverBullFlow flow,
@@ -56,7 +61,6 @@ class RecoverBullBloc extends Bloc<RecoverBullEvent, RecoverBullState> {
     required this._createEncryptedVaultUsecase,
     required this._storeVaultKeyIntoServerUsecase,
     required this._checkKeyServerConnectionUsecase,
-    required this._fetchVaultKeyFromServerUsecase,
     required this._decryptVaultUsecase,
     required this._restoreVaultUsecase,
     required this._connectToGoogleDriveUsecase,
@@ -67,6 +71,8 @@ class RecoverBullBloc extends Bloc<RecoverBullEvent, RecoverBullState> {
     required this._updateLatestEncryptedVaultTestUsecase,
     required this._torStatusUsecase,
     required this._torConfigPort,
+    required this._fetchVaultKeyWithStatusFromServerUsecase,
+    required this._recoverbullTelemetryCubit,
   }) : super(RecoverBullState(flow: flow, vault: preSelectedVault)) {
     on<OnVaultProviderSelection>(_onVaultProviderSelection);
     on<OnVaultSelection>(_onVaultSelection);
@@ -318,6 +324,12 @@ class RecoverBullBloc extends Bloc<RecoverBullEvent, RecoverBullState> {
         return;
       }
 
+      // Telemetry: register this backup as monitored and count this device's
+      // own store operation. Unawaited, never blocks the creation flow.
+      unawaited(
+        _recoverbullTelemetryCubit.recordLocalAttempt(backupIdHex: vault.id),
+      );
+
       emit(state.copyWith(vault: vault, vaultProvider: event.provider));
       log.fine('Vault created and key stored in server');
     } finally {
@@ -334,15 +346,36 @@ class RecoverBullBloc extends Bloc<RecoverBullEvent, RecoverBullState> {
 
       emit(state.copyWith(isLoading: true, vaultKey: null));
 
-      switch (await _fetchVaultKeyFromServerUsecase.execute(
+      switch (await _fetchVaultKeyWithStatusFromServerUsecase.execute(
         vault: event.vault,
         password: event.password,
       )) {
         case Ok(:final value):
-          emit(state.copyWith(vaultKey: value));
+          emit(state.copyWith(vaultKey: value.vaultKey));
           log.fine('Vault key fetched from server');
-          await _onVaultDecryption(OnVaultDecryption(vaultKey: value), emit);
+          // Telemetry: record this device's own operation and surface an
+          // immediate suspicious-activity alert when the server's counters
+          // exceed it. Unawaited, never blocks the recovery flow.
+          unawaited(
+            _recoverbullTelemetryCubit.recordLocalAttempt(
+              backupIdHex: event.vault.id,
+              attemptStatus: value.attemptStatus,
+            ),
+          );
+          await _onVaultDecryption(
+            OnVaultDecryption(vaultKey: value.vaultKey),
+            emit,
+          );
         case Err(:final failure):
+          // The targeted per-identifier lockout on the user's own fetch is
+          // an alarm signal: someone may be probing or griefing this backup.
+          if (failure is KeyServerTargetedRateLimitedFailure) {
+            unawaited(
+              _recoverbullTelemetryCubit.reportTargetedLockout(
+                backupIdHex: event.vault.id,
+              ),
+            );
+          }
           emit(state.copyWith(failure: _fetchKeyFailure(failure)));
       }
     } finally {
@@ -459,6 +492,12 @@ class RecoverBullBloc extends Bloc<RecoverBullEvent, RecoverBullState> {
         KeyServerRateLimitedFailure(:final retryIn) => VaultRateLimitedFailure(
           retryIn: retryIn ?? Duration.zero,
         ),
+        KeyServerTargetedRateLimitedFailure(:final retryIn) =>
+          VaultRateLimitedFailure(retryIn: retryIn ?? Duration.zero),
+        // Global 429 / capacity 503 are service pressure, not an attack:
+        // surface them as unavailability, never as a lockout alarm.
+        KeyServerOverloadedFailure() => const VaultKeyFetchFailure(),
+        KeyServerCapacityFailure() => const VaultKeyFetchFailure(),
         KeyServerUnavailableFailure() => const VaultKeyFetchFailure(),
         _ => RecoverBullUnexpectedFailure(failure.logMessage),
       };
@@ -475,6 +514,10 @@ class RecoverBullBloc extends Bloc<RecoverBullEvent, RecoverBullState> {
         KeyServerRateLimitedFailure(:final retryIn) => VaultRateLimitedFailure(
           retryIn: retryIn ?? Duration.zero,
         ),
+        KeyServerTargetedRateLimitedFailure(:final retryIn) =>
+          VaultRateLimitedFailure(retryIn: retryIn ?? Duration.zero),
+        KeyServerOverloadedFailure() => const KeyServerConnectionFailure(),
+        KeyServerCapacityFailure() => const KeyServerConnectionFailure(),
         KeyServerUnavailableFailure() => const KeyServerConnectionFailure(),
         _ => const VaultCreationFailure(),
       };

lib/features/recoverbull/router.dart

@@ -2,7 +2,7 @@ import 'package:bb_mobile/core/recoverbull/domain/entity/encrypted_vault.dart';
 import 'package:bb_mobile/core/recoverbull/domain/usecases/check_server_connection_usecase.dart';
 import 'package:bb_mobile/core/recoverbull/domain/usecases/create_encrypted_vault_usecase.dart';
 import 'package:bb_mobile/core/recoverbull/domain/usecases/decrypt_vault_usecase.dart';
-import 'package:bb_mobile/core/recoverbull/domain/usecases/fetch_vault_key_from_server_usecase.dart';
+import 'package:bb_mobile/core/recoverbull/domain/usecases/fetch_vault_key_with_status_from_server_usecase.dart';
 import 'package:bb_mobile/core/recoverbull/domain/usecases/google_drive/connect_google_drive_usecase.dart';
 import 'package:bb_mobile/core/recoverbull/domain/usecases/google_drive/fetch_latest_google_drive_backup_usecase.dart';
 import 'package:bb_mobile/core/recoverbull/domain/usecases/google_drive/save_to_google_drive_usecase.dart';
@@ -16,6 +16,7 @@ import 'package:bb_mobile/core/tor/data/usecases/tor_status_usecase.dart';
 import 'package:bb_mobile/core/tor/domain/ports/tor_config_port.dart';
 import 'package:bb_mobile/features/recoverbull/flow.dart';
 import 'package:bb_mobile/features/recoverbull/presentation/bloc.dart';
+import 'package:bb_mobile/features/recoverbull/presentation/telemetry/recoverbull_telemetry_cubit.dart';
 import 'package:bb_mobile/locator.dart';
 import 'package:flutter_bloc/flutter_bloc.dart';
 import 'package:go_router/go_router.dart';
@@ -53,8 +54,6 @@ class RecoverBullRouter {
               locator<StoreVaultKeyIntoServerUsecase>(),
           checkKeyServerConnectionUsecase:
               locator<CheckServerConnectionUsecase>(),
-          fetchVaultKeyFromServerUsecase:
-              locator<FetchVaultKeyFromServerUsecase>(),
           decryptVaultUsecase: locator<DecryptVaultUsecase>(),
           restoreVaultUsecase: locator<RestoreVaultUsecase>(),
           connectToGoogleDriveUsecase: locator<ConnectToGoogleDriveUsecase>(),
@@ -67,6 +66,9 @@ class RecoverBullRouter {
               locator<UpdateLatestEncryptedVaultTestUsecase>(),
           torStatusUsecase: locator<TorStatusUsecase>(),
           torConfigPort: locator<TorConfigPort>(),
+          fetchVaultKeyWithStatusFromServerUsecase:
+              locator<FetchVaultKeyWithStatusFromServerUsecase>(),
+          recoverbullTelemetryCubit: locator<RecoverbullTelemetryCubit>(),
         ),
         child: const RecoverBullFlowNavigator(),
       );